NetView for z/os V6.1 Packet Trace Analysis



Similar documents
Nalini Elkins Introduction to TCP/IP Diagnostics (Web-based Seminar)

Top 10 Tips for z/os Network Performance Monitoring with OMEGAMON Ernie Gilman

Top 10 Tips for z/os Network Performance Monitoring with OMEGAMON Session 11899

Top 10 Tips for z/os Network Performance Monitoring with OMEGAMON. Ernie Gilman IBM. August 10, 2011: 1:30 PM-2:30 PM.

Wharf T&T Limited DDoS Mitigation Service Customer Portal User Guide

Introduction to Mainframe (z/os) Network Management

LESSON Networking Fundamentals. Understand TCP/IP

NETWORK SECURITY WITH OPENSOURCE FIREWALL

Computer Networks. Chapter 5 Transport Protocols

TCP Performance Management for Dummies

Solving complex performance problems in TCP/IP and SNA environments.

Network Security. Marcus Bendtsen Institutionen för Datavetenskap (IDA) Avdelningen för Databas- och Informationsteknik (ADIT)

Nalini Elkins' TCP/IP Performance Management, Security, Tuning, and Troubleshooting on z/os

Why SSL is better than IPsec for Fully Transparent Mobile Network Access

Firewall Port Handling in TENA Applications

COMP 3331/9331: Computer Networks and Applications. Lab Exercise 3: TCP and UDP (Solutions)

Attack Lab: Attacks on TCP/IP Protocols

Network Security: Workshop. Dr. Anat Bremler-Barr. Assignment #2 Analyze dump files Solution Taken from

Sample Network Analysis Report

Port Scanning and Vulnerability Assessment. ECE4893 Internetwork Security Georgia Institute of Technology

Transport Layer Protocols

Network Security TCP/IP Refresher

z/os V1R11 Communications Server System management and monitoring Network management interface enhancements

How do I get to

Configuring Health Monitoring

B-2 Analyzing TCP/IP Networks with Wireshark. Ray Tompkins Founder of Gearbit

TCP Packet Tracing Part 1

Hands-on Network Traffic Analysis Cyber Defense Boot Camp

Host Fingerprinting and Firewalking With hping

Access Control: Firewalls (1)

OSI Model. Application Presentation Session Transport Network Data Link Physical. EE156 Computer Network Architecture

ICOM : Computer Networks Chapter 6: The Transport Layer. By Dr Yi Qian Department of Electronic and Computer Engineering Fall 2006 UPRM

The Problem with TCP. Overcoming TCP s Drawbacks

Debugging Network Communications. 1 Check the Network Cabling

Applications. Network Application Performance Analysis. Laboratory. Objective. Overview

Network Fundamentals Carnegie Mellon University

Visualizations and Correlations in Troubleshooting

IP Monitoring on z/os Requirements and Techniques

Network Monitoring On Large Networks. Yao Chuan Han (TWCERT/CC)

CYBER ATTACKS EXPLAINED: PACKET CRAFTING

TOE2-IP FTP Server Demo Reference Design Manual Rev1.0 9-Jan-15

Challenges of Sending Large Files Over Public Internet

Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP

MANAGING NETWORK COMPONENTS USING SNMP

Network Security Incident Analysis System for Detecting Large-scale Internet Attacks

Electromeet Participant Guide Optimising Your Internet Connection

Application-Centric Analysis Helps Maximize the Value of Wireshark

FIREWALL AND NAT Lecture 7a

Lab 3: Recon and Firewalls

Scanning Tools. Scan Types. Network sweeping - Basic technique used to determine which of a range of IP addresses map to live hosts.

AusCERT Remote Monitoring Service (ARMS) User Guide for AusCERT Members

Lab Exercise Objective. Requirements. Step 1: Fetch a Trace

ACHILLES CERTIFICATION. SIS Module SLS 1508

Large-Scale TCP Packet Flow Analysis for Common Protocols Using Apache Hadoop

Procedure: You can find the problem sheet on Drive D: of the lab PCs. 1. IP address for this host computer 2. Subnet mask 3. Default gateway address

Monitor network traffic in the Dashboard tab

Network and Services Discovery

CS 356 Lecture 16 Denial of Service. Spring 2013

Solution of Exercise Sheet 5

CS 640 Introduction to Computer Networks. Network security (continued) Key Distribution a first step. Lecture24

Introduction of Intrusion Detection Systems

Case Study: F5 Load Balancer and TCP Idle Timer / fastl4 Profile

High-Speed TCP Performance Characterization under Various Operating Systems

[Prof. Rupesh G Vaishnav] Page 1

TCP SYN Flood - Denial of Service Seung Jae Won University of Windsor wons@uwindsor.ca

Networking Test 4 Study Guide

1.0 Basic Principles of TCP/IP Network Communications

Chapter 5. Transport layer protocols

CSE 473 Introduction to Computer Networks. Exam 2 Solutions. Your name: 10/31/2013

IP address format: Dotted decimal notation:

Wireshark Lab: DNS. 1. nslookup

How To Manage Performance On A Network (Networking) On A Server (Netware) On Your Computer Or Network (Computers) On An Offline) On The Netbook (Network) On Pc Or Mac (Netcom) On

Packet Capture and Expert Troubleshooting with the Viavi Solutions T-BERD /MTS-6000A

Passive Network Traffic Analysis: Understanding a Network Through Passive Monitoring Kevin Timm,

Non-authoritative answer: home.web.cern.ch canonical name = drupalprod.cern.ch. Name: drupalprod.cern.ch Address:

Final exam review, Fall 2005 FSU (CIS-5357) Network Security

Using IPM to Measure Network Performance

Configuring NetFlow Secure Event Logging (NSEL)

Timing,... in Firewall Testing

Stateful Firewalls. Hank and Foo

SECURING APACHE : DOS & DDOS ATTACKS - I

Firewall Introduction Several Types of Firewall. Cisco PIX Firewall

Using AT commands to control TCP/IP stack on SM5100B-D modules

1. MOXA NPort Express TCP/IP to RS-232 server

BCS THE CHARTERED INSTITUTE FOR IT BCS HIGHER EDUCATION QUALIFICATIONS. BCS Level 5 Diploma in IT SEPTEMBER Computer Networks EXAMINERS REPORT

Using Double-Take Through a Firewall

Securizarea Calculatoarelor și a Rețelelor 13. Implementarea tehnologiei firewall CBAC pentru protejarea rețelei

La couche transport dans l'internet (la suite TCP/IP)

CS155 - Firewalls. Simon Cooper <sc@sgi.com> CS155 Firewalls 22 May 2003

Craig Pelkie Bits & Bytes Programming, Inc. craig@web400.com

OneSight Voice Quality Assurance

IP - The Internet Protocol

First Midterm for ECE374 03/09/12 Solution!!

La couche transport dans l'internet (la suite TCP/IP)

VisuSniff: A Tool For The Visualization Of Network Traffic

Host Discovery with nmap

Wireshark DNS. Introduction. nslookup

8.2 The Internet Protocol

Transcription:

NetView for z/os V6.1 Packet Trace Analysis Introduction This paper provides insights into the Packet Trace Analysis feature delivered in IBM Tivoli NetView for z/os V6.1, including an explanation of the types of errors analyzed as well as use cases that demonstrate the value of this new feature. Analyzing a packet trace is a process of sifting through data to find the clues that lead us to the problem. We search for the events that have occurred or are occurring that could indicate problems. With these clues, we determine the sequences and patterns which lead us to an understanding of the problem and what we can do to resolve it. Packet Trace Analysis Explained In analyzing a packet trace, we look for some key indicators. These are error flags associated with packets that indicate that an event has occurred. NetView processes 6 types of error flags: Zero Window Size, Window Probes, Retransmissions, Duplicate Acknowledgements, Delayed Acknowledgements, and Session Reset flags. Not all of these errors indicate real problems, in that they can often occur as part of the normal course of data transmission, such as Duplicate or Delayed Acks. However, the frequency and timing of errors -- whether there are many or there are several close together -- can indicate a congestion problem. A Reset flag for a session is a pretty certain indication that the session ended abnormally; but looking across multiple sessions involving a common end point, and seeing many of these with Reset flags could indicate an application failure. NetView also looks for Unacknowledged Syns. No error flag is captured for this, but it is a case where requests are sent to an endpoint and no acknowledgement is 1

returned. This is also an indication of an application failure, or possibly that an application or port is not active. NetView s Packet Trace Analysis function simplifies network problem determination by quickly gathering and presenting trace data in a summarized and easy-to-access format. NetView Packet Trace Analysis processes the trace data gathered, searches out and creates a summary of the error flags and Unacknowledged Syns found in the trace data and displays the summarized data. The NetView IPTRACE command provides an easy method of managing Communications Server packet traces by using fill-inthe-blanks panel input and program function keys to issue the Communications Server commands to start, stop or modify packet traces. Analysis results are summarized as shown in Figure 1. Fig. 1 The Packet Trace Analysis summary screen 2

To see a list of sessions containing each type of error, move the cursor to the appropriate field and press F4. (Note: UDP and ICMP sessions are also collected, but no analysis is done on these.) The list of all TCP sessions results are shown as in Figure 2. Fig 2. Listing of all TCP Sessions The list of sessions can be used to find trends, such as a specific host or port that has excessive sessions showing a particular error type, or multiple error flags across multiple sessions. Individual sessions in the list can be selected for additional detailed analysis. The results of selecting a specific session are shown as in Figure 3. 3

Fig 3. Session Analysis summary for a specific session This detailed view of the specific session gives you a full view of what is happening or has happened in the session, with access to the error flags as well as the details about the session and the individual packets that make up the session. From this detailed analysis, you can view the Communications Server Detailed Session report for the session, or select the individual packets for a detailed view of the data contained in the packet. Packets that contain any of the error flags are color-coded in the summary lists so you can find them more easily. To view a detailed demo of the NetView Packet Trace Analysis function, go to the Tivoli NetView for z/os section in the IBM Tivoli Media Gallery (http://www.ibm.com/developerworks/wikis/display/tivolimediagallery/home). Use Cases 4

Below are a couple of use cases where NetView Packet Trace Analysis helps in resolving network related issues. Why is response time soooooo slow? The Problem: You are receiving calls that network response time is slow. No specific host or application is noted. How NetView can help: Start a packet trace using IPTRACE. Use the ANALYZE function key in the IPTRACE display screen to analyze the sessions captured in the trace. Many of the error types summarized during analysis are associated with performance, including Retransmissions, Zero Window Size, etc.... Look for high concentrations of a specific error type and list the sessions. Is there a pattern (such as a specific host or port that shows up consistently)? Or do any of the sessions show a very high error rate (the count of packets vs. flags in the list)? Select individual sessions and drill down into the details of those sessions. I'm unable to connect to the billing application. The Problem: You have received a call at the help desk that users are not able to connect to the billing application. You verify that the application is running and you are able to access the host where it is running. There could be a problem in the network, or perhaps the application was not working, but now is working. How NetView can help: Use IPTRACE to start a packet trace for the application host IP and port. Collect trace data and use the ANALYZE function key to analyze the attempted connections. In the packet trace analysis summary look for the Unacknowledged Syns count. If there are sessions here, the application is not responding to connection requests. If there are not Unacknowledged Syns, check the Reset flag errors or Zero Window Size and Window Probes. In either case, drill down into the details of the individual sessions to see what data and errors are being transferred. 5

About the Author This paper was written by Paul Koch, a software developer on the IBM Tivoli NetView for z/os product. 6